dm: don't call report zones for more than the user requested
authorJohannes Thumshirn <johannes.thumshirn@wdc.com>
Tue, 4 Aug 2020 09:25:01 +0000 (18:25 +0900)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 21 Aug 2020 11:07:29 +0000 (13:07 +0200)
commiteb7ad9a06715cede4273075bb73b2f7c40558a3f
tree1a0acef3520defcec91fa9838d884818299dac9a
parent7bd13ac62979762f46a81b633ad2732aa764d577
dm: don't call report zones for more than the user requested

commit a9cb9f4148ef6bb8fabbdaa85c42b2171fbd5a0d upstream.

Don't call report zones for more zones than the user actually requested,
otherwise this can lead to out-of-bounds accesses in the callback
functions.

Such a situation can happen if the target's ->report_zones() callback
function returns 0 because we've reached the end of the target and then
restart the report zones on the second target.

We're again calling into ->report_zones() and ultimately into the user
supplied callback function but when we're not subtracting the number of
zones already processed this may lead to out-of-bounds accesses in the
user callbacks.

Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: Damien Le Moal <damien.lemoal@wdc.com>
Fixes: d41003513e61 ("block: rework zone reporting")
Cc: stable@vger.kernel.org # v5.5+
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/md/dm.c